On this page
Most MCP vulnerabilities are ordinary bugs in a new place. A tool lets the model's input escape a folder, reach a shell or a database, or fetch an internal URL, or an HTTP mode runs with no login. Below are the real advisories we track, the fixed versions, and what each did to a grade.
This list comes from our own watch list, not from vendor pages. Every night we check each entry in the official MCP Registry against OSV (which includes the GitHub Advisory Database) and against NVD. When a match lands on a server we grade, we re-score it. We re-checked every ID on this page against NVD or the GitHub Advisory Database on 14 November 2026. Grades here are our assessment from public signals, not an audit or a certificate.
Common MCP security vulnerabilities, by type
The same seven kinds of bug keep coming up in real advisories:
- Escaping the allowed folder. A path with
../or a symlink takes a file tool outside the folder you allowed. Examples: the official Filesystem server (GHSA-53mr-w429-c597), markdownify-mcp (CVE-2026-14699), Firecrawl'sfirecrawl_parse(CVE-2026-85606), code-graph-rag (CVE-2026-77604, CVE-2026-87008). - Model text reaching a shell, a database or an interpreter. Godot MCP's command injection (CVE-2026-25546), SQL injection in pgEdge's Postgres server (CVE-2026-126197, CVE-2026-125322), DQL injection in Dynatrace's old npm server (CVE-2026-123810).
- Fetching a URL the server shouldn't reach (SSRF). markdownify-mcp (CVE-2025-65512) and IBM's ContextForge gateway (CVE-2026-110194).
- An HTTP mode with no login or weak checks. Dynatrace's old npm server
ran tools for anyone who could reach its
--httpport (CVE-2026-123811). pgEdge didn't check theOriginheader, so a web page could reach it through DNS rebinding (CVE-2026-125320). - Bugs in the shared SDK. One request could run an HTTP server built on the official TypeScript SDK out of memory (CVE-2026-111768). Every server that ships the old SDK inherits it. Details in MCP TypeScript SDK vulnerabilities.
- Leaking tokens or identity. A Garmin library saved login tokens readable by other users (CVE-2026-54447). ContextForge's identity claims could be replayed (CVE-2026-110278).
- The client side. The MCP client can be the weak part too. OpenClaw let a
workspace config pass
NODE_OPTIONSorLD_PRELOADto the MCP servers it starts (CVE-2026-44995).
What makes these worse in MCP: the model picks the input, and text the model reads can steer it. A bug that needs "attacker-controlled input" in a normal app needs only a poisoned web page, issue or document here. That's why a server's login and what it can touch matter as much as its CVE list. See are MCP servers safe? for the checks before you install one.
MCP server vulnerabilities in servers we grade
Seven of the 207 servers we grade carried at least one known advisory on 14 November 2026, 13 advisories in all. Two more had advisories that didn't cost them anything, for the reasons in the last column.
| Server (grade on 14 Nov 2026) | Advisory | What goes wrong | Fixed in | What it did to the grade |
|---|---|---|---|---|
| Filesystem MCP Server (D) | GHSA-53mr-w429-c597, low, no CVE (25 Oct 2026) | A folder swapped for a link between the check and the write sends the write outside the allowed folders | 2.0.1 on Linux and macOS. Date versions such as 2026.8.31 get no fix. Still open on Windows | C to D on 7 Nov 2026 |
| Brave Search MCP (C) | CVE-2026-111768 and GHSA-f897-62hf-6gxq, both high, in the bundled MCP TypeScript SDK | One HTTP request can exhaust the server's memory | SDK 1.32.0. Brave's latest release, 2.1.4, still ships an older SDK | B to C on 8 Nov 2026. Only the optional HTTP mode is hit; stdio isn't |
| Garmin MCP (C) | CVE-2026-54447, high, in the garminconnect library (15 Jul 2026) |
Login tokens saved readable by other users on the machine | garminconnect 0.3.5. garmin_mcp still pins 0.3.2, but locks its own token files down after login |
B to C on 11 Nov 2026 |
| Firecrawl MCP (B) | CVE-2026-85606, high (4 Sep 2026) | firecrawl_parse reads any local file when a local install points at a self-hosted Firecrawl API |
No fix. The issue and the fix PR were both still open on 14 Nov | Graded with it. Partial credit, because the hosted server isn't affected |
| markdownify-mcp (D) | CVE-2025-65512 (high, SSRF), CVE-2026-14699 (folder allowlist escape), CVE-2026-14702 (predictable temp files) | Reaches internal services; reads outside the allowed folders | No fix. No commit since 1 May 2026 | Graded with them. No credit on the known-CVE check |
| Godot MCP (D) | CVE-2026-25546, high (4 Feb 2026) | Command injection through the project path | 0.1.1, inside 30 days | No cost on its own. The D comes from no login, no commits since April, and a second flaw fixed on main but not in the npm release |
| Elasticsearch MCP (Agent Builder) (B) | Four Agent Builder CVEs in Kibana in 2026 | Flaws in Agent Builder, the Kibana feature that serves the MCP endpoint | Kibana 9.4.4 to 9.4.7 | Graded with them. Partial credit: we couldn't confirm each fix came within 30 days |
| Dynatrace MCP (A) | CVE-2026-123811 (high), CVE-2026-123809 and CVE-2026-123810 (medium), CVE-2026-123812 (low), all in the archived npm package | Unauthenticated tool calls in --http mode, workflow and DQL injection, a write without approval |
1.8.7 to 2.1.1 | No change. The grade covers Dynatrace's hosted server, which is separate code. The listing now tells npm users to move off |
| n8n MCP (A) | CVE-2026-42236, high (April 2026) | Unauthenticated memory exhaustion through n8n's MCP OAuth client registration | 1.123.32, 2.17.4 and 2.18.1 (22 Apr 2026) | No change. Fixed within 30 days |
How a CVE moves a grade
The known-CVE check is one of four. A fix within 30 days of disclosure costs nothing. A slow fix (30 to 90 days) costs a little. An open advisory with a documented workaround costs most of the check, and an open one with no workaround costs all of it. Login, upkeep and connection safety are scored separately, so a CVE alone usually moves a grade by one letter. That's what happened to Filesystem, Brave Search and Garmin this month. The full rules are in how we score servers.
MCP vulnerabilities in servers and clients we don't grade
These came through our watch list but hit projects we haven't graded. No grade is implied. Newest first.
| Project | Advisory (severity) | What goes wrong | Fixed in |
|---|---|---|---|
| IBM ContextForge MCP Gateway 1.0.0 to 1.1.0 | CVE-2026-110278 (high), NVD 13 Nov 2026 | Identity claims passed to MCP servers could be replayed or exposed: static signatures, no per-gateway checks | IBM's 1.1.1 release notes (10 Nov) list the per-gateway identity fix |
| IBM ContextForge MCP Gateway 1.0.0 to 1.0.11 | CVE-2026-110194 (medium), NVD 13 Nov 2026 | SSRF: a signed-in user can make the gateway send requests inside your network | 1.1.0 and later are outside the stated range |
| pgEdge Postgres MCP Server before 1.1.0 | CVE-2026-126196 (high), CVE-2026-126197 (high), CVE-2026-126199 (medium), CVE-2026-126198 (low), NVD 12 Nov 2026 | Read-only mode bypassed by smuggling extra statements; SQL injection through custom pl-do tools; writes that skip the confirmation prompt |
1.1.0 (4 Sep 2026) |
| pgEdge Postgres MCP Server up to 1.1.0 | GHSA-jf8q-vh2f-mhq4 (high), no CVE yet, 11 Nov 2026 | Perl code injection through custom pl-do tools written in plperl |
The advisory names 1.1.1. On 14 Nov the repo had no 1.1.1 tag, only a 1.2.0 beta |
| pgEdge Postgres MCP Server before 1.1.0 | CVE-2026-125320, CVE-2026-125321, CVE-2026-125322 (all medium), NVD 10 Nov 2026 | No Origin check on HTTP (DNS rebinding); login rate limit dodged with a fake X-Forwarded-For; SQL injection in count_rows |
1.1.0 (4 Sep 2026) |
| code-graph-rag (PyPI) | CVE-2026-77604 (high), GitHub database 9 Nov 2026 | The MCP read_file tool reads any file through a path escape |
0.0.345 |
| code-graph-rag (PyPI) | CVE-2026-87008 (high), NVD 5 Nov 2026 | Structural search and replace follow symlinks out of the project folder | 0.0.589 |
| OpenClaw (AI agent and MCP client) | CVE-2026-44995 (medium), 11 May 2026 | A workspace config could pass NODE_OPTIONS, LD_PRELOAD or BASH_ENV to the MCP servers it starts, so a malicious workspace could run code |
2026.4.20 |
| OpenClaw | CVE-2026-45001 (medium), 11 May 2026 | An agent steered by prompt injection could change protected settings, including the MCP server config | 2026.4.20 |
| OpenClaw | CVE-2026-44118 (high), 6 May 2026 | Non-owner local clients could pose as the owner and run owner-only actions over its MCP loopback | 2026.4.22 |
code-graph-rag's own advisory list has three more high-severity shell approval bypasses without CVEs, fixed in 0.0.670 and 0.0.845. If you run it, take the newest release rather than the minimum fixed version above.
A pattern worth noticing: most pgEdge advisories were fixed in September, but NVD only published the CVEs in November. The date a CVE appears isn't the date you were exposed. Check the fixed version against what you run.
What our registry numbers show
Our Registry Watch mirrors the official MCP Registry. In the snapshot of 5 November 2026 it held 55,934 active entries.
- 9 of 19,765 checkable entries list a version with a known advisory. For 3 of them, that version is also the package's newest release and there's no fix. In the other 6, the package has moved on but the registry still lists an affected version.
- 36,164 entries can't be checked this way at all. They're Docker images, MCPB bundles or remote-only servers, with no package for OSV to check.
- NVD published 331 CVEs that mention MCP between 8 July and 5 November 2026, close to three a day. We could tie only 58 of them to a registry entry through its GitHub repo. We read a random 60 of the rest: 54 were really about MCP. 35 hit standalone MCP servers, 6 hit SDKs and 19 hit larger products with an MCP feature.
In our own directory, CVEs moved three grades down in November (Filesystem, Brave Search, Garmin). Two of the three were hit through a dependency: an SDK for Brave Search, a login library for Garmin. So check a server's dependencies, not only its own advisory page.
How to check an MCP server for vulnerabilities
- Look it up here first. Each server listing shows its known-CVE check in words. To check every server you run in one go, use Check your MCP stack.
- Check its registry entry. Our registry check guide shows where the GHSA and CVE issues for an entry appear, and what the registry doesn't verify.
- Query OSV with the exact version you run. Search osv.dev for the package name and compare against the version in your config, not the newest one. The registry can list an old version.
- Read the repo's Security tab. Some advisories never get a CVE (GHSA-f897-62hf-6gxq, GHSA-jf8q-vh2f-mhq4), so a CVE search alone misses them.
- Find unpinned servers. An
@latestor unversioned entry can pull a fixed version, or a broken one, without you noticing. Scan your MCP config shows which ones. - Prefer stdio for local servers. Several of the bugs above (the SDK memory flaws, Dynatrace's open HTTP mode, pgEdge's DNS rebinding) only reach you when a server listens on HTTP.
What this list can't tell you
- No advisory doesn't mean no bug. 68% of the 25,575 GitHub repos behind registry entries have no security policy, so many bugs are fixed in a commit and never get an advisory.
- OSV checks the package, not its dependencies. A server can pin a vulnerable library, as garmin_mcp does, and still show clean on OSV.
- Hosted servers are mostly closed source. They can fix a bug without telling anyone, so their CVE record says less.
- Our NVD feed covers 120 days and matches a CVE to an entry only through its GitHub repo, so older CVEs and ones without a repo link can be missed.
- A grade is an assessment from public signals. It isn't a code audit, and a server with no known CVE can still be a bad fit for what you give it.
If you run MCP servers for a team and want a second pair of eyes on the ones you depend on, get in touch.
Frequently asked questions
What is an MCP vulnerability?
A security bug in an MCP server, an MCP client or an MCP SDK. Most are bugs you'd find in any software, such as path traversal, injection or SSRF. In MCP they're easier to reach, because the model chooses the tool inputs and text it reads can steer it.
How many MCP CVEs are there?
NVD published 331 CVEs that mention MCP between 8 July and 5 November 2026, close to three a day. Not all of them hit standalone servers. In a random sample of 60 we couldn't tie to a registry entry, 35 did, 6 hit SDKs and 19 hit larger products with an MCP feature.
Which MCP servers have known vulnerabilities?
Among the servers we grade, seven carried a known advisory on 14 November 2026: Filesystem, Brave Search, Garmin, Firecrawl, markdownify-mcp, Godot and Elastic's Agent Builder. The table above shows what each one hits and whether a fix exists. For a server we don't list, check OSV and the repo's Security tab.
Should I stop using an MCP server that has a CVE?
Not always. If a fix exists, upgrade and pin that version. If it's open, read the advisory: many only apply to one mode, such as HTTP, and there may be a documented workaround. If there's no fix and no workaround, and the server can reach files, a shell or your data, switch to another server.